What it is: A managed Kubernetes service on AWS.

What it’s for:

• Run Kubernetes workloads with AWS-managed control plane.
• Integrate Kubernetes with AWS networking and IAM.

Key ideas:

• Core parts:
  • Cluster
  • Node Group
  • Service Account
• For least-privilege AWS permissions for pods, use:
  • IRSA + OIDC Provider

Exam cues:

• “Kubernetes on AWS” → EKS.
• “pods need different AWS permissions” → IRSA.

Hard words:

• *control plane* /kənˈtroʊl pleɪn/: lớp điều khiển
• *workload* /ˈwɝːkloʊd/: workload
• *integrate* /ˈɪntɪɡreɪt/: tích hợp

RBAC vs IAM Permissions